g:\jekins_work\workspace\sysoptasst_angus\product\win32\dbginfo\wmsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e532cdc3898749b222d1d5d55e8112ef088ead604b8678f8ce128d32ebf26d5b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e532cdc3898749b222d1d5d55e8112ef088ead604b8678f8ce128d32ebf26d5b.exe
Resource
win10v2004-20240419-en
General
-
Target
e532cdc3898749b222d1d5d55e8112ef088ead604b8678f8ce128d32ebf26d5b
-
Size
207KB
-
MD5
3aec118e3e8a4f11d969865bdbfbc8e1
-
SHA1
cc16e7626b6c51fdd3831860ab895ca5c39d22ab
-
SHA256
e532cdc3898749b222d1d5d55e8112ef088ead604b8678f8ce128d32ebf26d5b
-
SHA512
4e195f36ba7470e7b9dcb519d97d23da8208cbf1a754101c0c9ef813a543df0f20234f0b6ca16dfac24a5a244a72b7ed3c2b45a75cfb9c003f77c1d76e4ad07e
-
SSDEEP
3072:t/fHjq9hh/F1G2HDCitdiChHRBIDuOcqPvwJiqhktwjvHTQguyTcq3McRJbM/Lxg:hqfFBDCqhH8DuOcKvwE2UU7uhIdb6C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e532cdc3898749b222d1d5d55e8112ef088ead604b8678f8ce128d32ebf26d5b
Files
-
e532cdc3898749b222d1d5d55e8112ef088ead604b8678f8ce128d32ebf26d5b.exe windows:4 windows x86 arch:x86
6afaef5cc823cedbd1af0832778d8a52
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLogicalDriveStringsW
QueryDosDeviceW
FindResourceW
SizeofResource
LockResource
LoadResource
GetVersionExW
FindResourceExW
SuspendThread
TerminateThread
QueryPerformanceCounter
QueryPerformanceFrequency
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MultiByteToWideChar
GetTickCount
SetFileAttributesW
DeleteFileW
OpenProcess
RaiseException
GetCurrentThreadId
WaitForMultipleObjects
MoveFileW
GetLocalTime
Module32FirstW
TerminateProcess
LocalAlloc
LocalFree
GetSystemTimeAsFileTime
GetFileSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
CreateFileW
GetLastError
OutputDebugStringW
lstrlenW
GetProcAddress
FreeLibrary
WaitForSingleObject
GetModuleHandleW
SetEvent
LoadLibraryW
OpenEventW
GetCurrentProcessId
GetCurrentProcess
SetProcessWorkingSetSize
GetCommandLineW
RegisterWaitForSingleObject
UnregisterWait
Sleep
CreateThread
SetConsoleCtrlHandler
GetPrivateProfileStringW
WideCharToMultiByte
GetModuleFileNameW
GetFileAttributesW
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ResetEvent
InitializeCriticalSection
FatalAppExitW
lstrcmpiW
CreateEventW
HeapFree
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
GetProcessHeap
HeapSize
InterlockedExchange
user32
UnregisterClassA
PeekMessageW
DispatchMessageW
TranslateMessage
PostThreadMessageW
GetMessageW
advapi32
SetTokenInformation
DuplicateTokenEx
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
CreateProcessAsUserW
RegOpenKeyW
StartServiceCtrlDispatcherW
ControlService
StartServiceW
RegSetValueExW
QueryServiceStatus
DeleteService
RegCreateKeyExW
ChangeServiceConfig2W
ChangeServiceConfigW
RegCloseKey
OpenServiceW
RegQueryValueExW
CloseServiceHandle
RegOpenKeyExW
CreateServiceW
OpenSCManagerW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerExW
RegDeleteKeyW
SetServiceStatus
RegEnumKeyExW
shell32
CommandLineToArgvW
SHCreateDirectoryExW
shlwapi
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
SHDeleteValueW
SHRegSetUSValueW
PathFileExistsW
msvcp80
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?allocate@?$allocator@D@std@@QAEPADI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
wtsapi32
WTSEnumerateSessionsW
WTSWaitSystemEvent
WTSFreeMemory
ws2_32
gethostbyname
socket
WSAStartup
closesocket
imm32
ImmDisableIME
msvcr80
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
??3@YAXPAX@Z
memcpy_s
memmove_s
??0exception@std@@QAE@XZ
_snwprintf
memcpy
_vswprintf
free
wcsrchr
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
_waccess
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_wcsicmp
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_wcsnicmp
wcsncpy_s
_recalloc
calloc
wcslen
getchar
wcstol
_vscprintf
malloc
vswprintf_s
wcscmp
memcmp
strlen
memset
wcsstr
_vscwprintf
wcstoul
_wcsupr_s
_purecall
_beginthreadex
_swprintf
_wfopen
fclose
fwrite
vsprintf_s
setlocale
sprintf
__CxxFrameHandler3
_CxxThrowException
sprintf_s
strpbrk
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_vsnprintf_s
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
Sections
.text Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE